Security startup Hacktron AI says three researchers reached OpenAI employee accounts and its internal repository environment in less than 72 hours.[1] They chained remote code execution in the Discourse software behind OpenAI’s community forum with a separate flaw in OpenAI’s single sign-on system.[1][2]
The initial opening came from a malformed HEIF image processed through ImageMagick and the libheif decoder.[1][2] Discourse’s subsequent advisory classified the underlying image-upload vulnerability as high severity, with a CVSS score of 8.8, and released patched versions plus additional image-processing sandboxing.[4]
Hacktron says Claude Opus 4.8 identified the vulnerable code but struggled to produce a reliable exploit with memory protections enabled.[1] After Claude Opus 5 was released, the researchers say it produced a working ARM64 exploit within three hours and helped adapt it to the x86-64 environment used by Discourse.[1] The team then used the resulting exploit against OpenAI’s forum and combined it with the identity flaw to take over ChatGPT and Codex accounts belonging to OpenAI employees.[1][2]
One compromised employee account had Codex connected to OpenAI’s GitHub organisation.[1][2] Rather than inspect or download private source code, the researchers instructed Codex to create a harmless pull request in OpenAI’s internal monorepo as proof of access, then stopped testing and reported the flaws.[1][2][3] Hacktron says OpenAI fixed its side roughly 14 hours after the initial report, Discourse prepared its fix by 27 July, and OpenAI later paid a $6,500 bounty.[1]
The researchers describe the wider project as requiring only a few hours of human work for this attack, while Claude handled much of the exploit development.[1] They also state that skilled human guidance remained important and that the process was not fully autonomous.[1] That distinction matters: the story is not that subscriptions alone turned novices into elite hackers, but that capable models allowed a small expert team to work at a speed previously associated with much larger operations.[1][2]
The findings are primarily Hacktron’s account, although TechCrunch and The Verge independently reported the employee-account access, internal repository proof and subsequent fixes.[1][2][3] What remains unknown is how the same tools would perform in the hands of a well-funded hostile group that would not disclose the vulnerability or stop after proving access.
Supporting sources:
[1] Hacktron AI: Hacking OpenAI
[2] TechCrunch
[3] The Verge
[4] Discourse security advisory
Source: Hacktron AI